A workplace-harassment complaint rarely arrives as a clean, complete story. More often, an employer hears that something happened “a few weeks ago,” while the accused remembers a different date, witnesses recall only part of a conversation, and the most important messages are spread across email, text, Teams, Slack, or personal devices.
The challenge is not simply deciding which person seems more believable. A professional workplace investigation should identify what can be established, what remains disputed, what records support or contradict each account, and how the events fit together chronologically.
For DFW employers and legal professionals, a reliable timeline can become the backbone of a neutral investigation. It creates structure without assuming the outcome. It also helps decision-makers focus on policy-relevant facts instead of rumors, workplace politics, or conclusions formed too early.
Armstrong Investigations, PLLC supports businesses and legal teams throughout Dallas, Fort Worth, Plano, and the broader Dallas-Fort Worth Metroplex with professional investigative services, corporate investigations, witness interviews, records review, and other legal investigative services. The following framework explains how a timeline-centered approach can improve the quality of a workplace-harassment or misconduct investigation.
Important note: This article provides general investigative and organizational information. Workplace complaints can involve overlapping company policies and legal obligations. Employers should coordinate with appropriate human-resources personnel and qualified Texas employment counsel regarding specific situations.
Why conflicting accounts are normal
Conflicting accounts do not automatically mean that someone is lying. People experience the same event from different positions, with different levels of attention and different assumptions about what matters.
For example:
- One employee may remember the exact words used but not the date.
- A manager may remember a meeting but not who else was present.
- A witness may have heard only the final portion of a conversation.
- A complainant may describe a pattern that developed over several weeks.
- The accused may focus on intent while the company needs to understand the conduct and its workplace impact.
- A coworker may repeat what someone told them without having firsthand knowledge.
Memory also changes over time. Employees may discuss an incident with colleagues, review old messages, or reconstruct the sequence after a complaint is made. That does not automatically invalidate their account, but it makes careful documentation more important.
A timeline gives the investigator a neutral way to compare accounts. Instead of asking, “Who is right?” the investigation can ask:
- What event is being described?
- When and where did it likely occur?
- Who had firsthand knowledge?
- What records might confirm or challenge the account?
- Which company policy or workplace expectation is relevant?
- What facts remain uncertain?
That approach helps keep the investigation fact-focused and avoids turning the process into a personality contest.
Step one: define the investigation before collecting everything
A workplace investigation can quickly become unmanageable if the scope is not defined at the beginning. The initial complaint may include several allegations, unrelated workplace disputes, or broad statements about a hostile environment. Those concerns may be important, but each should be separated into specific issues that can be investigated.
A practical investigation plan should identify:
- The person making the complaint
- The person or people accused of misconduct
- The specific conduct being reported
- The approximate dates and locations
- Potential witnesses
- Relevant policies or procedures
- Known records and communication systems
- The investigator and decision-makers
- Any immediate workplace or preservation concerns
The scope may need to change as new information develops. A written plan is not a rigid script. It is a starting point that explains what the investigation is intended to establish and why certain evidence is being reviewed.
For example, a complaint may begin with an allegation involving an inappropriate comment during a meeting in Plano. During interviews, the investigator may learn about a later text exchange, a follow-up meeting in Dallas, and a schedule change in Fort Worth. Those events may or may not belong in the same investigation. The investigator should document why additional events were included, excluded, or referred for separate review.
The Texas Workforce Commission’s workplace-investigation guidance emphasizes promptness, objectivity, planning, witness identification, document preservation, and organized interviews. Those same principles are useful when building a defensible chronology.
Step two: preserve messages and records early
A timeline is only as reliable as the underlying information. Many workplace records disappear through routine deletion, device replacement, automatic retention settings, or employees editing or deleting conversations after learning about a complaint.
Preservation should begin as soon as the employer reasonably recognizes that relevant information may be needed. Depending on the circumstances, potentially important sources may include:
- Email and attachments
- Text messages
- Microsoft Teams, Slack, or other workplace messaging platforms
- Calendar invitations and meeting notes
- Human-resources reports
- Performance documentation
- Timekeeping and scheduling records
- Building-access or badge records
- Security footage
- Relevant customer or vendor communications
- Work-related messages on personal devices, when properly authorized and appropriate
- Social media communications connected to the workplace issue
Preservation is not the same as collecting every piece of data a company possesses. The goal is to identify reasonably relevant sources, protect them from routine loss, and document how information was obtained.
A basic evidence log should record:
- Evidence identifier
- Description of the item
- Source or custodian
- Date collected
- Collection method
- File format
- Location where the original is stored
- Any limitation or concern affecting the item
Screenshots can be useful for context, but they may omit metadata, surrounding messages, or the full conversation. Where feasible, an export or original electronic record may provide better context. If a screenshot is used, preserve the surrounding conversation and document who supplied it and when.
Investigators should also distinguish between an original record, a copy, a summary, and a statement about a record. These are not interchangeable. A witness saying, “I saw a message that said…” should be marked as a witness account unless the message itself is located and preserved.
Step three: create a chronology that separates facts from assumptions
A reliable chronology should be easy for another person to follow. It should not read like an argument for one side.
One useful format includes the following columns:
| Date and time | Event | Source | Confidence or limitation | Policy relevance |
|---|---|---|---|---|
| March 4, 9:15 a.m. | Meeting invitation sent | Calendar export | Exact timestamp available | Workplace interaction |
| March 4, 2:00 p.m. | Conversation reportedly occurred | Complainant interview | Time is approximate | Alleged conduct |
| March 4, 2:18 p.m. | Follow-up message sent | Message export | Original source preserved | May provide context |
| March 5 | Concern reported to manager | Manager interview and email | Report date confirmed; details vary | Notice and response |
This format prevents several common errors.
First, it distinguishes the date an event allegedly occurred from the date it was reported. Those may be separated by hours, days, or weeks.
Second, it identifies the source of each entry. A calendar record may establish that a meeting was scheduled, but not necessarily what was said during the meeting.
Third, it records uncertainty instead of hiding it. “Late afternoon” should not be converted into an exact time simply because the timeline looks cleaner that way.
Fourth, it connects facts to policy review without deciding the final outcome. An entry can be relevant to a respectful-workplace policy, communication policy, anti-retaliation procedure, or supervisory conduct standard without stating that a violation occurred.
When accounts conflict, place both accounts in the chronology. For example:
- Complainant: conversation occurred in a private office on Tuesday afternoon.
- Accused: conversation occurred in an open workspace on Wednesday morning.
- Calendar: both individuals were scheduled together Tuesday afternoon.
- Access record: accused entered the office suite Tuesday afternoon.
- Witness: heard raised voices but could not identify the subject of the conversation.
The timeline does not need to resolve every disagreement immediately. It should show what each source contributes and where further inquiry may be necessary.
Step four: conduct interviews designed to recover sequence
Witness interviews should be private, respectful, and structured around firsthand knowledge. The objective is not to pressure a person into agreeing with an existing theory. It is to learn what the person observed, when they observed it, and how they know it.
A strong interview generally begins with broad, open-ended questions:
- “Please describe what led to this concern.”
- “What do you remember happening?”
- “Who was present?”
- “Where were you located?”
- “What happened immediately before and after?”
- “How certain are you about the date?”
- “Did you make or receive any related messages?”
- “Who else may have firsthand knowledge?”
Follow-up questions can then narrow the sequence:
- “Was that before or after the team meeting?”
- “Was the message sent before you spoke with the supervisor?”
- “Did you leave the room before the conversation ended?”
- “Did anyone mention the issue to you later?”
- “Are you describing what you personally observed or what someone told you?”
The investigator should avoid leading questions such as, “The manager threatened the employee, correct?” A better question would be, “What did the manager say?” The difference matters because it allows the witness to provide their own description rather than adopting the investigator’s wording.
Interviews should also address the witness’s relationship to the people involved, possible bias, and whether they have discussed the matter with others. Bias does not automatically disqualify a witness. It is simply information that may help decision-makers evaluate the account.
Detailed notes should identify the interview date, participants, start and end times, documents shown, key statements, and follow-up items. Recording practices should be handled carefully and transparently, with attention to company policy and applicable law. Absolute confidentiality should not be promised. Instead, witnesses can be told that the company will limit information to those with a legitimate need to know, subject to legal or operational requirements.
At the conclusion of each interview, ask the witness to identify anything that may have been missed. This simple question often produces additional names, messages, or dates.
Step five: use records to test: not replace: human accounts
Electronic records can strengthen a timeline, but they rarely tell the entire story. A calendar confirms that a meeting was scheduled. It may not confirm that everyone attended or what was discussed. A message timestamp establishes when a message was sent, but not necessarily the sender’s intent.
Useful corroboration may include:
- Calendar entries compared with access records
- Message timestamps compared with witness recollections
- Timekeeping records compared with claimed work locations
- Security footage compared with meeting times
- Email threads compared with verbal accounts
- Policy acknowledgments compared with the conduct being reported
- Prior complaints or reports, reviewed only when relevant and appropriately authorized
The investigator should document both supporting and contradictory information. Selectively collecting only evidence that supports the first theory can undermine the investigation.
This is especially important in large DFW workplaces where employees may work across multiple locations, including Dallas, Fort Worth, Irving, Arlington, Plano, Frisco, McKinney, Denton, Richardson, Garland, Rockwall, and surrounding counties. A person’s location may change during a single day, and different systems may use different time zones, timestamps, or retention practices.
The timeline should account for those technical details. If a message appears to have been sent at a time when a witness says the parties were together, that may be useful: but only after confirming the relevant time settings and whether the message was delayed, forwarded, or accessed from another device.
Step six: identify policy-relevant facts without making legal conclusions
A neutral investigation does not need to decide broad legal questions to be useful. Its role may be to establish whether specific conduct occurred and whether that conduct appears inconsistent with company policy.
Policy-relevant facts may include:
- The exact words or actions reported
- Whether the conduct was repeated
- Whether it occurred in person or through electronic communication
- Whether a supervisor or manager was involved
- Whether the conduct occurred during work, at a work event, or through a work-related channel
- Whether the person reported the concern and to whom
- How the company responded
- Whether anyone was instructed to preserve records
- Whether there were later schedule, assignment, or communication changes
- Whether additional employees may have experienced similar conduct
- Whether anyone raised concerns about retaliation or interference
Avoid loaded labels when a precise description is available. Instead of writing “the supervisor harassed the employee,” an interim chronology might state, “The employee reported that the supervisor sent three messages containing comments the employee considered inappropriate. The messages were preserved and reviewed against the company’s communication policy.”
That wording preserves the allegation without presenting it as an established fact.
Step seven: document credibility factors carefully
Credibility analysis should not be reduced to demeanor. A nervous witness may still provide accurate information, and a confident witness may be mistaken. A more reliable assessment considers several factors together:
- Internal consistency
- Consistency with other accounts
- Corroboration by records
- Specificity of the recollection
- Personal opportunity to observe
- Possible motive to misrepresent
- Whether the account changed after new information emerged
- Whether the witness distinguishes firsthand knowledge from hearsay
- Whether the account is plausible in light of the physical and digital evidence
The investigation record should explain why certain evidence was given more or less weight. It should also identify unresolved conflicts rather than pretending they do not exist.
A professional investigator may be able to help an employer or legal team organize interviews, locate relevant witnesses, review publicly available information, conduct professional surveillance when the assignment legitimately requires it, and prepare an objective investigative report. Any records access, device review, or surveillance plan should be coordinated with appropriate internal procedures and professional guidance.
Step eight: prepare a report that another person can audit
The final report should allow a qualified reviewer to understand how the investigation was conducted and how the facts were developed. It should generally include:
- Investigation scope and assignment
- Dates and key milestones
- Investigator identity and role
- Interview list
- Evidence reviewed
- Chronology of relevant events
- Summary of each material account
- Corroborating and contradictory evidence
- Credibility considerations
- Findings tied to specific company policies
- Open questions or limitations
- Administrative follow-up items, if requested
Keep investigative records separate from general personnel materials when appropriate, and restrict access based on legitimate business need. Confidential information should not be circulated broadly, repeated casually, or discussed in ways that could create additional workplace harm.
After the investigative phase, management may need to address policy concerns, workplace conditions, training, reporting channels, or follow-up monitoring. Those decisions should be made by the appropriate company leaders with suitable professional support.
When DFW employers should consider outside investigative support
An external investigator may be useful when:
- The complaint involves a senior executive or owner
- Internal HR personnel have a conflict
- Multiple employees are involved
- The complaint spans several DFW offices
- Important witnesses are former employees or third parties
- Messages or records require specialized collection
- The employer needs a neutral fact-finder
- The matter may become part of a business dispute or litigation
- The internal team lacks time or experience to conduct structured interviews
Armstrong Investigations, PLLC serves businesses and legal professionals across the DFW Metroplex and North Texas. Our corporate investigations and background-check services and support for legal professionals can be coordinated around the needs of a particular assignment. Our broader investigative services include professional surveillance, witness-related support, records research, and organized reporting.
For employers searching for a private investigator Dallas or private investigator Fort Worth, the key question is not simply whether an investigator can gather information. It is whether the work will be conducted neutrally, documented carefully, and communicated in a way that helps decision-makers understand the facts.
A reliable timeline is built, not assumed
Conflicting accounts are common in workplace-harassment and misconduct investigations. The answer is not to force every witness into the same version of events. The answer is to preserve the available evidence, interview people methodically, identify what each source actually establishes, and record uncertainty with the same care used to record confirmed facts.
A timeline-centered investigation gives DFW employers a practical framework for moving from allegation to organized fact review. It helps separate firsthand knowledge from rumor, conduct from interpretation, and policy questions from legal conclusions.
When the matter is sensitive, high-risk, or difficult to manage internally, professional investigative support can add structure and independence. The goal is a record that is fair to the people involved, useful to the organization, and clear enough for appropriate professionals to evaluate.
Jasen A. Armstrong, J.D.
Armstrong Investigations, PLLC
P: 214-851-3800 | W: armstronginvestigations.com
Texas DPS Lic. #: 166353101 | Affiliated with TCS Consulting (TX DPS Lic. #: C20493) & Howard Law, PLLC